Modern communication practice has seen the development of virtual private networks (VPNs), which are useful for an organization which desires to provide a secure communication system within the organization but, owing for example to the geographical separation of parts of the organization, cannot conveniently employ a private local area network (LAN) separated from external networks by secure gateways or firewalls. One way in which a VPN can be organized is to employ datagrams which employ UDP as a transport protocol and a tunneling protocol such as L2TP, and to encapsulate datagrams using a enciphering protocol within packets that can be transported generally, i.e. packets conforming to an internetworking protocol (usually IP). The encapsulation may, where the overall transport protocol is IP, be an IPSEC (IP Security) protocol such as AH (Authentication Header) or ESP (Encapsulation Security Protocol). The former provides source authentication and data integrity but the latter provides, at the cost of greater complexity, confidentiality as well. In what follows it will be assumed that ESP is employed as an enciphering protocol but it will be understood that the invention extends to the decoding of UDP datagrams which are encapsulated by means of other enciphering protocols and which carry payloads via other tunneling protocols.
When a UDP datagram is prepared for transmission from a sender there is a computation of a checksum. A UDP checksum is computed by performing a 1's complement of the sum of all the 16-bit words in the entire UDP datagram and a pseudo-header (ignoring any overflow). The result is put into the checksum field of the UDP header.
The purpose of the checksum is to provide for error checking in the event that one of more of the links between source and destination does not provide error checking. If the datagram reaches the destination without error, the sum of the 16-bit words in the UDP datagram added to the checksum should provide in the absence of error a result consisting of all 1 s. If any bit in the result is a zero the datagram is in error and may be discarded.
When therefore a UDP datagram encapsulated in a packet reaches the end of a tunnel defined by the tunneling protocol, the receiver at or defining the end of the tunnel must first decipher the packet, using the relevant (secret) deciphering key. It is then necessary to verify the UDP checksum.
Any method of deciphering requires the use of memory. If shared memory is used for deciphering and the verification of the checksum, the whole packet (i.e. the datagram and its encapsulation) is read into memory and deciphered; then the checksum is verified. Such a process requires a lot of time (clock cycles) first to decipher the full packet and then to run through it again to verify the checksum. It limits the number of tunnels a system can terminate in a given time. Moreover the latency also increases.
If separate memories are used for deciphering and the verification of the checksum, the packet is decoded fully in one memory and then passed onto another memory wherein the checksum would be verified. Such a scheme requires extra memory, because each memory must be large enough to accommodate a packet of maximum size; again, with consecutive functions, there is an increase of the latency of tunnel termination. Such an increase is a serious disadvantage, especially if voice data is being tunneled through a VPN.